Peer Identifier except Address does not work
-
I try to connect pfSense to an FreeSwan through IPSec Site2Site Tunnel, with an Dynamic IP. On my Site the IP is static, on the FreeSwan Site its dynamic. The IP is being resolved by Dyndns.
remote xxx.xxx.xxx.xxx
{
ph1id 62;
exchange_mode main;
my_identifier address PFSENSE-IP;
peers_identifier user_fqdn "REMOTE@dyndns.org";
ike_frag on;
generate_policy = off;
initial_contact = on;
nat_traversal = off;ca_type x509 "ca-61.crt";
dpd_delay = 30;
dpd_maxfail = 5;
support_proxy on;
proposal_check claim;proposal
{
authentication_method pre_shared_key;
encryption_algorithm aes 128;
hash_algorithm sha1;
dh_group 2;
lifetime time 28800 secs;
}
}Phase 1 fails always with:
Apr 10 16:34:44 racoon: DEBUG: compute DH's shared.
Apr 10 16:34:44 racoon: DEBUG: xxxxxx fe24b27d 4a71fd7c adcf355a 98149943 a260bfd3 6281c367 79c17390 ca5a0937 00d2e9d8 76988c22 5fa542b8 d0f71e2c ff5c4a6e 64cbd719 xxxxx a6ee4175 xxxxx 449d319e 2f953d6f 86da1003 8b648f3a 785a5a2c 4c0a63fe fa3dd16e e6087920 5ffc6bd5 439831ca 34b3060c 93659655 d8fe4aef xxxxxx
Apr 10 16:34:44 racoon: [REMOTE-IP] ERROR: couldn't find the pskey for REMOTE-IP.
Apr 10 16:34:44 racoon: [REMOTE-IP] ERROR: failed to process ph1 packet (side: 0, status: 6).
Apr 10 16:34:44 racoon: [REMOTE-IP] ERROR: phase1 negotiation failed.On other Tunnels with static IP on the Remote Site I changed peers_identifier to address REMOTE-IP. Peer identifier = Peer IP Address in GUI to make the Tunnels work.
I search a lot through Google, pfsense Forum and pfsense Redmime without success.
It seems to me that Tunnels with other Peer Identifier than IP Addresses are not possible with pfSense.
Has anyone similar an experience?
-
It works just fine if you use the dyndns hostname as the DN. EG- myhostname.dyndns.org.
I've done remote IPsec clients using FQDN, but I haven't tried site to site, easier to use DN. -
You mean Distinguished Name on Tunnels Tab, which resolves to
peers_identifier fqdn "REMOTE@@dyndns.org"?This was my first Intention, which did not work. After that I tried several Settings suggested in the Forums like NAT Traversal on/off, DPD on/off.
-
I mean set the remote host to the DNS record of the host, eg- foobar.dyndns.org, and use Distiguished Name as the peer identifier, putting the DNS name in the box (foobar.dyndns.org). On the dynamic side, use DN as the peer id, again using the DNS name (foobar.dyndns.org).
Works fine for me with pfSense on both sides. YMMV -
Double, Tripple and more Times checked. Another try this morning with DN, but always
ERROR: couldn't find the pskey for ERROR: failed to process ph1 packet (side: 0, status: 6).Luckily this is the only Site2Site with Dynamic IP on the Remote Site. I changed all other Tunnels to
Peer identifier = Peer IP address
to make them work.Has anyone successfully established a Connection between PfSense 2.0.2 and Linux Openswan U2.6.21/K2.6.30.10-105.2.23.fc11.i586 (Fedora 11) or an LANCOM Box with an Peer identifier other than Peer IP address?
